                                    (fs/find-files signeddir pem-pattern)))]
     (map (partial get-certificate-status settings) all-subjects)))
 
-;; TODO docs
 (schema/defn sign-existing-csr!
+  "Sign the subject's certificate request."
   [{:keys [csrdir] :as settings} :- CaSettings
    subject :- schema/Str]
   (let [csr-path (path-to-cert-request csrdir subject)]

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; certificate_status endpoint

;; TODO docs
(defn certificate-state
  [cert-or-csr cacrl]
  (if (utils/certificate-request? cert-or-csr)
    "requested"
    (if (utils/revoked? (utils/pem->crl cacrl) cert-or-csr)
      "revoked"
      "signed")))

;; TODO docs
(defn dns-alt-names
  [cert-or-csr]
  (mapv (partial str "DNS:")
        (utils/get-subject-dns-alt-names cert-or-csr)))

;; TODO docs
(defn fingerprint
  [cert-or-csr algorithm]
  (->> (utils/fingerprint cert-or-csr algorithm)
       (partition 2)
       (map (partial apply str))
       (str/join ":")
       (str/upper-case)))

;; TODO docs
(schema/defn ^:always-validate
  get-certificate-status :- CertStatus
  [{:keys [csrdir signeddir cacrl]} :- CaSettings
   subject :- schema/Str]
  (let [cert-or-csr         (if (fs/exists? (path-to-cert signeddir subject))

    (sign-existing-csr! settings subject)
    (revoke-existing-cert! settings subject)))

(schema/defn ^:always-validate certificate-exists? :- schema/Bool
  "Do we have a CSR or certificate for the given subject?"
  [{:keys [csrdir signeddir]} :- CaSettings
   subject :- schema/Str]
  (or (fs/exists? (path-to-cert signeddir subject))
      (fs/exists? (path-to-cert-request csrdir subject))))

(schema/defn ^:always-validate delete-certificate!
  "Delete the certificate and/or CSR for the given subject.
   Note this does not revoke the certificate."
  [{:keys [csrdir signeddir]} :- CaSettings
   subject :- schema/Str]
  (let [cert (path-to-cert signeddir subject)
